Procedure examples

Aria-body has the ability to execute a process using runas.

The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via `%TEMP%\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run`.

PipeMon can attempt to gain administrative privileges using token impersonation.

KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.

REvil can launch an instance of itself with administrative rights using runas.

ZxShell has a command called RunAs, which creates a new process as another user or process context.

Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.

Empire can use Invoke-RunAs to make tokens.

PoshC2 can use Invoke-RunAs to make tokens.

Mafalda can create a token for a different user.

Cobalt Strike can make tokens from known credentials.

SILENTTRINITY can make tokens from known credentials.

DarkGate relies on parent PID spoofing as part of its "rootkit-like" functionality to evade detection via Task Manager or Process Explorer.

PipeMon can use parent PID spoofing to elevate privileges.

KONNI has used parent PID spoofing to spawn a new `cmd` process using `CreateProcessW` and a handle to `Taskmgr.exe`.

Cobalt Strike can spawn processes with alternate PPIDs.

Empire can add a SID-History to a user if on a domain controller.

Mimikatz's MISC::AddSid module can append any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.

TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.

QuietSieve can identify and search networked drives for specific file name extensions.

MURKYTOP has the capability to retrieve information about shares on remote hosts.

Stuxnet enumerates the directories of a network resource.

AvosLocker has enumerated shared drives on a compromised network.

KOPILUWAK can use netstat and Net to discover network shares.

Sardonic has the ability to execute the `net view` command.

RansomHub has the ability to target specific network shares for encryption.

Medusa Ransomware has identified networked drives.

Bad Rabbit enumerates open SMB shares on internal victim networks.

Emotet has enumerated non-hidden network shares using `WNetEnumResourceW`.

Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.

DUSTTRAP can identify and enumerate victim system network shares.

BADHATCH can check a user's access to the C$ share on a compromised machine.

BlackByte 2.0 Ransomware can identify network shares connected to the victim machine.

WastedLocker can identify network adjacent and accessible drives.

InvisiMole can gather network share information.

WhisperGate can enumerate connected remote logical drives.

Conti can enumerate remote open SMB network shares using NetShareEnum().

Diavol has a `ENMDSKS` command to enumerates available network shares.

BlackCat has the ability to discover network shares on compromised networks.

IcedID has used the `net view /all` command to show available shares.

ShimRat can enumerate connected drives for infected host machines.

Avaddon has enumerated shared folders and mapped volumes.

Flagpro has been used to execute `net view` to discover mapped network shares.

HELLOKITTY has the ability to enumerate network resources.

Babuk has the ability to enumerate network shares.

PlugX has a module to enumerate network shares.

Cuba can discover shared resources using the NetShareEnum API call.

DEATHRANSOM has the ability to use loop operations to enumerate network resources.

Clambling has the ability to enumerate network shares.

Akira can identify remote file shares for encryption.